ci: split verifying package checksums into its own job (MR 6366)

This simplifies the build_changed_aports job, and makes it a lot
easier to use dynamic pipelines in the future

.ci/lib/build_changed_aports.py

@@ -24,23 +24,6 @@ def build_strict(packages, arch):
                             "--arch", arch, ] + list(packages))
 
 
-def verify_checksums(packages, arch):
-    # Only do this with one build-{arch} job
-    arch_verify = "x86_64"
-    if arch != arch_verify:
-        print(f"NOTE: doing checksum verification in build-{arch_verify} job,"
-              " not here.")
-        return
-
-    if len(packages) == 0:
-        print("no packages changed, not doing any checksums verification")
-        return
-
-    common.run_pmbootstrap(["build_init"])
-    common.run_pmbootstrap(["--details-to-stdout", "checksum", "--verify"] +
-                           list(packages))
-
-
 if __name__ == "__main__":
     # Architecture to build for (as in build-{arch})
     if len(sys.argv) != 2:
@@ -93,18 +76,9 @@ if __name__ == "__main__":
     # No packages: skip build
     if len(packages) == 0:
         print(f"no packages changed, which can be built for {arch}")
+        sys.exit(0)
 
-    else:
-        verify_only = common.commit_message_has_string("[ci:skip-build]")
-        if verify_only:
-            # [ci:skip-build]: verify checksums and stop
-            print("WARNING: not building changed packages ([ci:skip-build])!")
-            print("verifying checksums: " + ", ".join(packages))
-            verify_checksums(packages, arch)
-        else:
-            # Build packages
-            print(f"building in strict mode for {arch}: {', '.join(packages)}")
-            build_strict(packages, arch)
+    build_strict(packages, arch)
 
     # Build packages in extra-repos/systemd
     # FIXME: this should probably be more generic, if other repos are added later?
@@ -127,15 +101,6 @@ if __name__ == "__main__":
         # No packages: skip build
         if len(systemd_pkgs) == 0:
             print(f"no packages changed, which can be built for {arch}")
+            sys.exit(0)
 
-        else:
-            verify_only = common.commit_message_has_string("[ci:skip-build]")
-            if verify_only:
-                # [ci:skip-build]: verify checksums
-                print("WARNING: not building changed packages for extra-repos/systemd: ([ci:skip-build])!")
-                print("verifying checksums: " + ", ".join(systemd_pkgs))
-                verify_checksums(systemd_pkgs, arch)
-            else:
-                # Build packages
-                print(f"building in strict mode for {arch}, from extra-repos/systemd: {', '.join(systemd_pkgs)}")
-                build_strict(systemd_pkgs, arch)
+        build_strict(systemd_pkgs, arch)

.ci/lib/verify_checksums.py

@@ -0,0 +1,22 @@
+#!/usr/bin/env python3
+# Copyright 2025 Pablo Correa Gomez
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+# Same dir
+import common
+
+def verify_checksums(packages):
+    if len(packages) == 0:
+        print("no packages changed, not doing any checksums verification")
+        return
+
+    print("verifying checksums: " + ", ".join(packages))
+    common.run_pmbootstrap(["build_init"])
+    common.run_pmbootstrap(["--details-to-stdout", "checksum", "--verify"] +
+                           list(packages))
+
+if __name__ == "__main__":
+    # Get and print modified packages
+    common.add_upstream_git_remote()
+    packages = common.get_changed_packages()
+    verify_checksums(packages)

.ci/verify-checksums.sh

@@ -0,0 +1,16 @@
+#!/bin/sh -e
+# Description: verify checksums of modified packages
+# Options: native
+# Use 'native' because it requires running pmbootstrap.
+# https://postmarketos.org/pmb-ci
+
+if [ "$(id -u)" = 0 ]; then
+	set -x
+	wget "https://gitlab.postmarketos.org/postmarketOS/ci-common/-/raw/master/install_pmbootstrap.sh"
+	sh ./install_pmbootstrap.sh
+	exec su "${TESTUSER:-pmos}" -c "sh -e $0"
+fi
+
+export PYTHONUNBUFFERED=1
+
+.ci/lib/verify_checksums.py

.gitlab-ci.yml

@@ -120,6 +120,15 @@ kernel-kconfig:
     - .ci/lib/gitlab_prepare_ci.sh
     - .ci/kconfig.sh
 
+# Verify checksums
+verify-checksums:
+  stage: lint
+  rules:
+    - if: *mr_rule
+  script:
+    - .ci/lib/gitlab_prepare_ci.sh
+    - .ci/verify-checksums.sh
+
 # MR settings
 # (Checks for "Allow commits from members who can merge to the target branch")
 mr-settings: